Keep App Session secrets secret #39853
Conversation
|
@jentfoo If you get a chance can you let me know what you think about the Do you think there are any security implications to re-signing the JWT? An alternative solution would be for the Proxy service to pass the client's public key in an additional request header so that the App Service can verify the original client-signed JWT. |
|
The overall idea sounds good to me; I'll take a look at actual code ~tomorrow. |
There was a problem hiding this comment.
Seems like an improvement to me
An alternative solution would be for the Proxy service to pass the client's public key in an additional request header so that the App Service can verify the original client-signed JWT
I don't believe this would add any additional security. Ultimately you would still be reliant on what the proxy provides. So I think having the signature done by the proxy is more explicit and likely safer.
Joerger
force-pushed
the
joerger/protect-app-session-secrets
branch
from
908efa0 to
29f14fb
Compare
|
The PR changelog entry failed validation: Changelog entry not found in the PR body. Please add a "no-changelog" label to the PR, or changelog lines starting with |
github-actions
bot
added
size/md
tsh
|
The PR changelog entry failed validation: Changelog entry not found in the PR body. Please add a "no-changelog" label to the PR, or changelog lines starting with |
Joerger
added
the
no-changelog
public-teleport-github-review-bot
bot
removed request for
smallinsky and
rudream
Joerger
force-pushed
the
joerger/protect-app-session-secrets
branch
from
2242561 to
eb33d91
Compare
Proxy verifies and signs jwt tokens Ensure backwards compatibility
rewriteRequest method with an improved Azure app check Fix GetAppSession backward compatibility check
Joerger
force-pushed
the
joerger/protect-app-session-secrets
branch
from
eb33d91 to
f4cd315
Compare
|
/excludeflake * |
This PR updates App Session endpoints to keep App Session secrets secret to the user. These secrets are only needed by the Proxy Service to create connections to App Services on behalf of the clients. Giving the clients access to these secrets can lead to degraded security, especially with Per-session MFA and Hardware Key support.
The only client consumer of App Session secrets before this PR was
tsh proxy azure, which uses the app session private key to sign a JWT token auth header. This Auth header would pass through the proxy and get validated by the App Service.With this change, the client instead signs a JWT token with its own private key. The Proxy checks the header, verifies it with the client public key, and resigns it with the app session key. Finally, the App Service verifies and parses the JWT token with the app session public key.
Related #39588